Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

malformed host header

148 views
Skip to first unread message

Dariusz Brzeziński

unread,
Jul 25, 2001, 2:36:41 PM7/25/01
to

I just found such things in error.log:

[Thu Jul 19 17:07:28 2001] [error] [client 64.9.73.34] Client sent
malformed Host header
[Thu Jul 19 18:11:23 2001] [error] [client 206.97.16.179] Client sent
malformed Host header
[Thu Jul 19 18:28:32 2001] [error] [client 211.240.41.8] Client sent
malformed Host header
[Thu Jul 19 18:38:43 2001] [error] [client 211.99.170.66] Client sent
malformed Host header
[Thu Jul 19 18:59:32 2001] [error] [client 209.251.14.7] Client sent
malformed Host header
[Thu Jul 19 19:09:19 2001] [error] [client 150.214.141.84] Client sent
malformed Host header
[Thu Jul 19 19:37:27 2001] [error] [client 24.162.228.181] Client sent
malformed Host header
[Thu Jul 19 20:01:46 2001] [error] [client 24.28.53.85] Client sent
malformed Host header
[Thu Jul 19 20:09:43 2001] [error] [client 212.175.64.238] Client sent
malformed Host header
[Thu Jul 19 20:22:07 2001] [error] [client 198.189.146.72] Client sent
malformed Host header
[Thu Jul 19 21:04:59 2001] [error] [client 162.127.143.98] Client sent
malformed Host header
[Thu Jul 19 21:05:02 2001] [error] [client 63.106.93.138] Client sent
malformed Host header
[Thu Jul 19 21:09:39 2001] [error] [client 195.242.135.134] Client
sent malformed Host header
[Thu Jul 19 21:18:50 2001] [error] [client 208.193.40.11] Client sent
malformed Host header

if this would be only one hist, but it seems one person tried from
various servers. What do you think?

I'm running Slack 7.1 _ Apache 1.3.19

TIA

Dariusz Brzezinski
---news/views/reviews/Implozja---
e-mail: dariusz.b...@implozja.kalisz.pl
http://www.implozja.kalisz.pl
http://www.implozja.com

Jurgen Philippaerts

unread,
Jul 25, 2001, 4:04:03 PM7/25/01
to
"Dariusz Brzeziński" wrote:
>
> I just found such things in error.log:
>
> [Thu Jul 19 17:07:28 2001] [error] [client 64.9.73.34] Client sent
> malformed Host header
> [Thu Jul 19 18:11:23 2001] [error] [client 206.97.16.179] Client sent
> malformed Host header

> if this would be only one hist, but it seems one person tried from


> various servers. What do you think?
>
> I'm running Slack 7.1 _ Apache 1.3.19

take a look at your access log, and see what's being requested at the
time you get this error.
that will probably tell you what/where to start looking.


ps: wrong newsgroup :) i don't see this to be slackware related. i don't
know if there's an apache newsgroup though :)

Jurgen.

MartinW

unread,
Jul 25, 2001, 4:10:30 PM7/25/01
to
Dariusz Brzeziński <NOSPAMdarius...@implozja.kalisz.pl> wrote:

> I just found such things in error.log:

> [Thu Jul 19 17:07:28 2001] [error] [client 64.9.73.34] Client sent
> malformed Host header
> [Thu Jul 19 18:11:23 2001] [error] [client 206.97.16.179] Client sent
> malformed Host header
> [Thu Jul 19 18:28:32 2001] [error] [client 211.240.41.8] Client sent
> malformed Host header
> [Thu Jul 19 18:38:43 2001] [error] [client 211.99.170.66] Client sent
> malformed Host header
> [Thu Jul 19 18:59:32 2001] [error] [client 209.251.14.7] Client sent
> malformed Host header
> [Thu Jul 19 19:09:19 2001] [error] [client 150.214.141.84] Client sent

> if this would be only one hist, but it seems one person tried from
> various servers. What do you think?

> I'm running Slack 7.1 _ Apache 1.3.19

> TIA


Red Code worm, been and gone! only affected Windoze IIS so nowt to
worry about.

www.cert.org as an advisoy on this

Martin

Dariusz Brzeziński

unread,
Jul 25, 2001, 4:28:04 PM7/25/01
to
On Wed, 25 Jul 2001 20:04:03 GMT, Jurgen Philippaerts
<jur...@pophost.eunet.be> wrote:


>ps: wrong newsgroup :) i don't see this to be slackware related. i don't
>know if there's an apache newsgroup though :)
>
>Jurgen.

sorry, but you know - if you're newbie you search for help where you
are often :-) Thanks fo help anyway.

Jesper Dybdal

unread,
Jul 25, 2001, 5:02:29 PM7/25/01
to
Dariusz Brzeziński <NOSPAMdarius...@implozja.kalisz.pl> wrote:

>I just found such things in error.log:
>
>[Thu Jul 19 17:07:28 2001] [error] [client 64.9.73.34] Client sent
>malformed Host header
>[Thu Jul 19 18:11:23 2001] [error] [client 206.97.16.179] Client sent
>malformed Host header

...

>if this would be only one hist, but it seems one person tried from
>various servers. What do you think?

What you are seeing is the effects of the worm described in
http://www.cert.org/advisories/CA-2001-19.html . The various IP addresses are
various infected servers.

No need to worry, it cannot harm an Apache server.

--
Jesper Dybdal, Denmark.
http://www.dybdal.dk (in Danish).

Weeve

unread,
Jul 25, 2001, 7:31:36 PM7/25/01
to
Just as a reference, the newsgroup suggested by the Apache group is
comp.internet.www.servers.unix

Weeve

0 new messages